CVE-2026-74048
Cryptographic policy bypass via FIPS activation failure
CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure. Not in the CISA KEV catalog. Low advisory severity (CVSS 3.7, Red Hat).
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-74048 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Low
- CVSS base score
- 3.7 (Red Hat)
- Weakness
- CWE-455
- Fixed releases
- Apache: 11.0.27, 10.1.61, 9.0.123
- Red Hat: tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1, RHSA-2026:85926
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-74048; bulletin-wide values are not repeated here.
Is CVE-2026-74048 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-74048 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-74048?
Upgrade to a fixed release named by the vendor:
- Apache: 11.0.27, 10.1.61, 9.0.123
- Red Hat: tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1, RHSA-2026:85926
- Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue. (Apache)
Vendor advisory comparison
Apache
1 advisory- Advisory severityUnrated
Advisory [CVE-2026-74048] Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat
CVE-2026-74048Source published Source updated
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
- Affected products in this advisory
- Apache Tomcat
- Source-reported affected versions
- 11.0.0-M14 through 11.0.26
- 10.1.22 through 10.1.60
- 9.0.92 through 9.0.122.
- through 9.0.122
- Source-reported fixed versions
- 11.0.27
- 10.1.61
- 9.0.123
- Mitigation guidance
- Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Red Hat
1 advisory- Advisory severityLow3.7
Low [CVE-2026-74048] Cryptographic policy bypass via FIPS activation failure
CVE-2026-74048Source published Source updated
Cryptographic policy bypass via FIPS activation failure. Red Hat rates this low (CVSS 3.7). Weakness: CWE-455. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
- Related products — impact not confirmed
- Red Hat Hardened Images
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- tomcat10-main-10.1.61-0.1.hum1
- tomcat11-main-11.0.27-0.1.hum1
- RHSA-2026:85926
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.